Ping YOUniverse: The next stage of human authentication

AUSTIN, TEXAS — A chief theme at this year's Ping YOUniverse conference Tuesday and Wednesday of last week (Sept. 1 and 2) was the notion of "verified trust," which Ping Identity views as the next stage of the authentication of humans. "Every step in the ID journey must evolve," said Ping Identity CEO and founder Andre Durand during his keynote Tuesday, adding that "trust must be earned through continuous validation." Durand said verified trust can be considered as the fusion of fraud detection, access management, and ID verification. Several Ping YOUniverse speakers later called it "the continuous verification of the human user at every stage of the journey." More than a login All agreed that verified trust goes much further than just logging into a service or device. To Ping, that's implicit trust, and it's just the beginning. The next stage is adaptive trust, which many organizations are already familiar with. Its features include multi-factor authentication (MFA) and context-based threat detection. For example, when you log into your company email account while traveling and you're asked to type in an additional code, that's adaptive trust making sure you're not an impostor trying to break in from an unfamiliar location. The final stage is what Ping defines as explicit trust, narrowing down the authentication factors to one specific individual. This can involve biometric identification, device-bound information, and other unique identifiers. Furthermore, explained Ping's Business Lead of PingOne Recognize Ali Nazem and Senior Sales Engineer Dalton Slattery in a Wednesday breakout session, regular access logins are only one of three "doors" by which an adversary can break into an organization. The other two are the hiring process, as we've seen with multiple incidents of North Korean spies using false identities to work for Western companies, and the account-recovery and technical-assistance route, exploited recently by Scattered Spider and other groups that try to fool support technicians. Verified trust is designed to address both. Facial recognition without stored images The most important factor in verified trust is Ping's approach to facial recognition, PingOne Recognize, which uses "zero-knowledge biometrics" created by a European company called Keyless.io that Ping bought last year. To register with the PingOne Verify platform, such as when starting a new job or sitting for a remote job interview, the individual first provides a document that can be remotely verified, such as a passport with an NFC chip containing the user's data. The user then takes a selfie with their smartphone, and PingOne Recognize verifies the "liveness" of the image before the image is converted into a numerical representation by the PingID app and stored in the device's secure storage area. The numerical key is encrypted, and the unique encryption key is shared with Ping's servers. In this way, no image of the user's face is stored on any device. If an adversary were to break into Ping's or a client's servers looking for personal data, the adversary would find only encryption keys with nothing to decrypt. When the user opens the PingID app on their phone, a quick scan of the user's face confirms their identity and unlocks the app. If the user appears to be in an unfamiliar location, the server can request that the user take a new selfie for additional verification. Nazem and Slattery explained that Ping One Recognize solves fundamental problems with two other standard forms of facial recognition. The regular phone-based kind tells you only who has the phone, they said, but not whether the phone holder is indeed the authorized user. Meanwhile, centralized biometrics servers are more secure, but not private. A similar "zero-knowledge" principle applies to desktop computers, even those shared by multiple employees. Facial images of each worker are captured during the registration process and turned into encrypted mathematical representations stored in the desktop's hardened storage area. Keys to unlock those representations are stored on the Ping Identity platform's remote servers. Ping calls this "one device, many faces." The corollary is "one face, many devices," such as when a user has both a smartphone and a computer. Because of the danger of hiring untrustworthy remote workers, Ping recommends that "step-up" verification challenges asking for new facial scans and other strong forms of authentication be presented to new hires during their first year of employment. "You need to introduce friction at the right times using context, intelligence and orchestration," said Ping VP of Workforce Segment Strategy Gaurav Sharma during a breakout session Tuesday. Smile for the camera Verified trust can also assist IT technicians by smoothing out the account-recovery process and making it much more difficult for adversaries to socially-engineer helpdesks, said Darryl Jones, Ping VP of Consumer Segment Strategy, during a breakout session Tuesday. "Call-center account-recovery calls can cost a company millions per year," and that's not even counting the losses due to social engineering, Jones said. Using Ping's system, PingOne Verify, which includes PingOne Recognize, the account-recovery process can be much faster and cost-efficient than asking about the user's mother's maiden name. When the account-recovery request is made, the tech-support agent sends a push notification to the user's registered smartphone, which asks for a selfie as a facial-recognition and liveness check. If the selfie passes, access to the account is restored. The same mechanism foils attackers, who fail the selfie test. Jones said one bank that switched to verified account recovery saw a 79% reduction in account-takeover fraud. Making sure your vendors are who they say they are A similar process applies to verifying the identities of third-party vendors, suppliers and partners, said Ping Director of Product & Solutions Marketing for Workforce & B2B Jen Toscano and Senior Director of Workforce Strategy Stuart Proffitt. In a Wednesday breakout session, they explained how even organizations that tightly manage their own employees' access and privileges often fail to do so when it comes to third parties. Companies often try to manage third-party access with a clunky combination of customer identity and access management (CIAM) and workforce identity and access management (IAM), Proffitt and Toscano said. The end result is that third-party involvement in data breaches is rapidly increasing. The 2026 Verizon Data Breach Investigations Report (DBIR) said that 48% of all breaches involved third parties, a 60% increase over the previous year. "Ninety-eight percent of organizations partner with at least one third party that's been breached," said Toscano, adding that that figure doesn't even account for fourth-party relationships, or your supplier's suppliers. She gave the example of a car manufacturer that might have thousands of employees, but also relationships with suppliers and partners and their employees, as well as dealerships and their employees and consumers. "The answer is B2B IAM across a connected ecosystem," Toscano said, which blends aspects of CIAM and IAM without stretching the concepts of either one. B2B IAM recognizes that external identities are different external ones, she and Proffitt said, and that relationships define access and trust has to extend beyond the perimeter. Verified trust is at the heart of B2B IAM, Toscano added, creating an identity fabric for what she called "B2B2X." PingOne Verify can onboard employees of a partner or vendor as it would your own employees, she explained, authenticating each when they connect to your company's systems and issuing context-based challenges when necessary. Passwordless verification Looking forward, verified trust and PingOne Recognize are a key part of Ping's march toward a passwordless future, both Durand and Sharma said. Sharma said Ping was trialing device-bound passkeys that are not synced across devices, matching the original passkey specification of one passkey for each pairing of a device and an online account. The biometric aspects of PingOne Recognize and PingOne Verify provide additional factors. Durand said that Ping would soon roll out PingID Desktop Passwordless, extending passwordless logins into browsers for companies that want to eliminate passwords altogether. "The highest assurance is based on device-bound biometrics combined with device-bound passkeys," said Sharma. "On the path to passwordless, we're nearly there."